asyncrat | 6977b3527a4a9d36457d1460d2a35a10169d13829de9b09b5f07c6e7350488bc

Sharing

Copy URL Twitter E-mail

General

Target
6977b3527a4a9d36457d1460d2a35a10169d13829de9b09b5f07c6e7350488bc
Size 45KB
Sample260703-eky4lsf16n
SHA256 6977b3527a4a9d36457d1460d2a35a10169d13829de9b09b5f07c6e7350488bc
MD5 c4ea4546458f10c4b95178195a32821a
SHA1 25c431d50007dba2731e703bf7f8dc736e82512c
SHA512 5ff04802775ad2cdc94ae17b5911b5de807a3eaa40b6b11897955a3d7c41172c00531cc62fc4a0681e770984b8145130a3667e4eee9cd780f8df4cf68a56a9a8
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1RpPEcPIMzjbwgX3iundCpIk7JdEgR3g5WSABDo:kuSOpTPOP2W8VDZEhM3b3XSu8Ik7J5Vo
TLSH
T1D9233B003BE9853BF2BE4F7899F26145867BF2632603D5491CC441DB5613FC68A92AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

golicolombia.com:80
golicolombia.com:22
golicolombia.com:8080
golicolombia.com:8880
golicolombia.com:2052
golicolombia.com:2082
golicolombia.com:2086
golicolombia.com:2095
golicolombia.com:443
golicolombia.com:2053
golicolombia.com:2083
golicolombia.com:2087
golicolombia.com:2096
golicolombia.com:8443
www.golicolombia.com:80
www.golicolombia.com:22
www.golicolombia.com:8080
www.golicolombia.com:8880
www.golicolombia.com:2052
www.golicolombia.com:2082
www.golicolombia.com:2086
www.golicolombia.com:2095
www.golicolombia.com:443
www.golicolombia.com:2053
www.golicolombia.com:2083
www.golicolombia.com:2087
www.golicolombia.com:2096
www.golicolombia.com:8443
downadup.golicolombia.com:80
downadup.golicolombia.com:22
downadup.golicolombia.com:8080
downadup.golicolombia.com:8880
downadup.golicolombia.com:2052
downadup.golicolombia.com:2082
downadup.golicolombia.com:2086
downadup.golicolombia.com:2095
downadup.golicolombia.com:443
downadup.golicolombia.com:2053
downadup.golicolombia.com:2083
downadup.golicolombia.com:2087
downadup.golicolombia.com:2096
downadup.golicolombia.com:8443
invasive.golicolombia.com:80
invasive.golicolombia.com:22
invasive.golicolombia.com:8080
invasive.golicolombia.com:8880
invasive.golicolombia.com:2052
invasive.golicolombia.com:2082
invasive.golicolombia.com:2086
invasive.golicolombia.com:2095
invasive.golicolombia.com:443
invasive.golicolombia.com:2053
invasive.golicolombia.com:2083
invasive.golicolombia.com:2087
invasive.golicolombia.com:2096
invasive.golicolombia.com:8443
cryptolocker.golicolombia.com:80
cryptolocker.golicolombia.com:22
cryptolocker.golicolombia.com:8080
cryptolocker.golicolombia.com:8880
cryptolocker.golicolombia.com:2052
cryptolocker.golicolombia.com:2082
cryptolocker.golicolombia.com:2086
cryptolocker.golicolombia.com:2095
cryptolocker.golicolombia.com:443
cryptolocker.golicolombia.com:2053
cryptolocker.golicolombia.com:2083
cryptolocker.golicolombia.com:2087
cryptolocker.golicolombia.com:2096
cryptolocker.golicolombia.com:8443

Mutex

PJdPyZnHOzCl

Attributes

delay
0
install
true
install_file
67lu.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6977b3527a4a9d36457d1460d2a35a10169d13829de9b09b5f07c6e7350488bc
- Size 45KB
- SHA256 6977b3527a4a9d36457d1460d2a35a10169d13829de9b09b5f07c6e7350488bc
- MD5 c4ea4546458f10c4b95178195a32821a
- SHA1 25c431d50007dba2731e703bf7f8dc736e82512c
- SHA512 5ff04802775ad2cdc94ae17b5911b5de807a3eaa40b6b11897955a3d7c41172c00531cc62fc4a0681e770984b8145130a3667e4eee9cd780f8df4cf68a56a9a8
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1RpPEcPIMzjbwgX3iundCpIk7JdEgR3g5WSABDo:kuSOpTPOP2W8VDZEhM3b3XSu8Ik7J5Vo
- TLSH
  T1D9233B003BE9853BF2BE4F7899F26145867BF2632603D5491CC441DB5613FC68A92AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2